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im&m i ] s-£ft c ^ is k * • ~>^^ A^co^s; 

u JttiJeti&^otr-i is K^rttc-T*— ^*^-t-6. 
fc5^7>rry k • -fup^j* - is b*$faibm<D# 

h • ^n^A . ^ v K^lr?*— ^SrlsaM- 
h > > Mfc^E— K • y — — ^ (c 

MW) B#SrSifcU ^<omiti:T^l)^r-is3is\z 

s&^&itMzT^y ^—is 3 istzm&&mm^ mm 

[B!*^2i &mr?^x'gm (mac) ±ffi»fT«fp 

w» t-t%, ft** i i-iEgtco^isf i^^juRi 



^W^T £ tt 5 ftr lea — if flfeS £r^*i~ 6 # v -?7 y ~7 % 

t*— ^ -^od r ^ i? ^ \z Bl-f S *itr U"</w S: 

^5B*«^f>^— ^(Ea£(w|!B-r5K*S:^-< K£ 

S*flltwJ:oT»3eS^fc»>f ^ I D^o/nt^ 

^fS (MAC) ±ft^T^^{£ l-^/w . ^nir^^ii 

-r^K^dsSR^BSf^^^r^-t^BTtStw/^S. iff 

afrE»R* s Br**** h miRm s ^*fflj i^Ssi£ ztiz>*f 



Htri-^-— s*i" 5^-— if ' >f i'*:?*:— 
tt-t-S^^y^iSrS^^tfC^Srl^a^-f-S, fit* 

^ 7t^2o J: — * fti&fc J; t>^5>^i-^)^* -6 ^£ 
S e>^tf^i:«:«N»i:"*-S. »*S 5 td|E«feco^ft 

10 [ft** 7] ^Mco^-s ^ K^^T'o^f-fWtS 
ffitr^t^»J» (DAC) Sfc^T^-fc^fflRSrJB^ 
KMi-Sfc*^+5^ft«F«IS:*r-t-'5a««»*«tt-t--5 

^t^^ft^-^te^fe 

20 ^mi-^^^^t. 

ffiElRv*- ^^^^^r^-t^^S (MAC) ^ 

rp^tes/^«H*i (dac) ^rpm^ 

^mmt uxffiriEiB«*aBf##twmiaa^J9Bs*sr 
ffir!Ba^*is*t^jc»u'c, sWE»«*s3f^r#dsstr 

30 |ES« ^ ^ — is**<D'?as<7'4± X~m g "7^ — 9 * 

^--if ^^ttjEifiia^s**!^ w-r 6 *\ ^*^^ f9 m 
afrSEiiR* g ^> mrfEiiiR* @ ^*iaj \zm * 
^-^5s**Ko?Bu^»^^eaE«fe*:^i-s^ 

40 >f^e>WHE31««S«*«|^)^>r V K^n^f^ii 
*a<o^ffltt(cBBi-Siife*S*ffi!li^a^7"y^i:, 

[ft** 9] strfB»«^— ^^^.tsBtriatea&^^s/ 

so -</u«r#Jt s a> ^ 5 -5 <t 5 if twif *i~5 
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[0 0 0 1] 
[0 0 0 2] 

(GUI) 

fflStfCt^5^^^K^at*<^lofi, AT&T Bell Labo 

ratoriesifcs&SBBS^/tUN I X^^U— *r 4 • 

7^ A (UN I XfiNovell&tf>i»Bt-C4>'5) _tT*ibf^^-5 30 

rx 4 1/ • S/^rAj (Massachusetts Institut 
e of Technology <D Kfll) "C£><5 0 
[0 0 0 3] Sf^B^/Wl. Defence Intelligence 
Agency (D I A) tfV'Requirementsfor System High an 
d Compartmented Mode Workstations" (CMWS^<!:^ 

0) (7)S*^fr(Oiot$)6 0 Z.coMj£x*n, Win, 3c 

w<z><fc5*!?-<>'K* i^/Mi* S^^^ 7 40 

i-e^*»ft«ffi^/u*^^T^-fe^fl ! 3a (MA 
C) ^<^^#|;i^/u£ttit£ff^ 

i&< iT^TO^-lFfttfo r±ffittftij/jjLj USB 



"C&Sirffl^LT. ^©t^v^x^ h (Off ^^/u^ 
[0 0 0 4] aflfe^^uirWW^^^oaifiB^/Pdsa 

AC^^/uo±fi#fT^i--<TO#«l^-if 

ffiX*£Z>o CMWTIi, ^— ifASi-^TO^^/^M*- 

[000 5] x^^yKi)- ^taii l-^ooxi^— 

^r— ->3 l/b-*?*) t ^3t6o X^^^K^-C/^^ 
AT'fi, Xih— ^<fi, Xt e rmft^lffl**»0 

1 ocor^y ^— ^ * 

[0 0 0 6] SecureWarefi, ^ tUX^^yF^ 
. ^7 t ASrffiffl'f-5rfT|R(Z>CMWS:«ix.Tl^dS, ^7 
v V • T> K • ^ h«kf^(^(±fiJ3U^^ 7^/y K* 

tt*< >■ • — ^t^fffit5 0 SecureWare 

<^-f ^ yr-ya >xn, m%-<n*r—$ • $4rf 



I 



5 

Smithfifefi"Secure Multi-Level Windowing in a Bl Cer 
tifiable Secure UNIX Operating System" (Winter 198 
9 USENIX Conference Proceedings) i^l^T, ^ ^ 

fc^»o ff«9^/W«ift(i*ofc<^SttT»/^*t\ Ca 
rsonft6*i"From B2 to CMW: Building a Compartmented M 
ode Workstation on a Secure Xenix Base" (Proceed in 
gs of the AIAA/AS IS/IEEE Third Aerospace Computer 
Security Conference, 1987) djol^T, CMW-f 

-r v^y y yf-ya >-x^i. -^or^ u— -7^ >^ • 

i/XTJ^k ITXEN I X£r. ■ j e^^<— ^ . r>>f ^ 
• i/^rA^ UTViewnix^r^ffi U ^yh-T^K- 

SUIlflSrffiffl IX^6 0 (XEN I Xfi-^-T ^ aV7F 

Viewnixf^Five Paces Software^ <D $5 

^T*fc5 0 ) 
[0 0 0 7] 

[0 0 0 8] 

>- h-fbs-=e — K • V— $**r— >3 is (CMW) 

i?*^<7> jiffies — ■ ^ > K ^ I D^^ffli~-5o 
fflSBSrg*"*-* # y ;y y^&S^-j-S J; 5 
««u-</u«3C51K*f^*i^jK"- hi-S (MACifif 
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10 ft, IR^5*ftll;:J:oT}|tSiifc!?^ ^ K>> I Dfc 

fi, MAC±tt»ffl*l-5*flli5 s fi^^ • ^P't^i: 
ilff i"5 ^ #lwil«(03f^r#dSS*«|tw|!Bi-5S±«ai 

la. iMRSBSf^fi* «»ox»»KJ:9aiR^* 

2. a^ssff^^fea^JBs^iBi-teass^s^ 

C friz J; 9 , 

2a. ^dsjgiSSrffllB-r-Si:, — v^^fiT' 

(DAC) S^r^ir^^JPS$r^^i-6fci6(7)+^ 
40 J; 19 . ft«^^</U*S*B L, LabelChange*^ <h ^ 5 *f 

^{R^r^sMi-efcs^fflfcBSrsijwr^y ^— ^ 



5/s VJ: 51R/^7 7<0*ds»flS u^/i-^Kim 

r^y ^r— s/g ^iia^irt^x— ^*R^as 

[0 0 0 9] lE*ij:^«)ffi©att, W^Cfi. 

[0 0 10] 

[*W<0*fifc<ojgffil x^yh^-^r^fT 4 10 

[ooii] ^ c -essftias, #twia i &&m*tz> t . 

7>fT:/ hcoio^ LTiliR-^-*— l 0 

AN) *^afi4ttfri 0 3KU: <9SaftStLfca«:cox 
f-— 0 -l *5j:cf l 0 2%^is 0 ^mwxt-/^ 

jRt;t?>*L"C^5o iifS WtW 1 0 3 *3§WtwJ;-5 

XU, — 10 7. ^air^ - — ^ i 30 

0 8, XDMt 

w^^wr . 1 1 0&<^£>£ o xr:/y^ 

l^fifetc. LTttMBU « 

ttSttfcAIXtermS»*r^^ 1 1 4 £^ UTilff Stft: 
10 3 tilfSi-^-^/^U^/U • 7/JJ v-3 > 1 1 
2l:I*7^!l^->3yi 1 3 

5c xtwnoi*fcnio2ii, iW£J8L-c 

K£ . -v^ — v?-^ i o v?-^ l 0 0OJ; 5 

[o o i 2] a^B(ix^>f >- K*(o»agT*feSo a 

(ice cm) djztbtf. »R(i^7-f hPfleo^ 
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c^ffijiXjB^HSR^*S^«v^^S'&"*- 

st)OTfc5 0 ^^5^>*l ^o^jfe-ettxa^sasg 

[0 0 13] x»RKK^atttt, 1Sak<DT?!)fr—i' 

3 is&lsy h*ffl\ 53"J^)77 P y>r-^3y^-Xh 
Srfr5»&f:fc. M^^T^y ^—i/3 V^jfeaEi--5X5B 

[0 0 14] »«u^</uaEJEaK««^B«j<i N igtso^ 
M A C ^ ^</u*3 J; O^ff* 7 ^</u^— ^ -f -5 * id 

/^fllj*^^ 3 ^KSir: J; »9 ^fg^icfr 5 r. t i>* 

6 0 ^-r^#^x*^. ^— ^^^^/u^iEi-^-t- 

i<LWn^-<x<Dm^-^ t iM^^-if^rp^ § tt, 

•f'^T^^^/^ieSrBW-f-S J: 5 i-, CMWcogf+o 
[ 0 0 1 5 ] m 2 ^Jt^ y h • TV K * 7s v 

^^E^i--5o IU2(7)r^^ y mn^*— "J 

*e>*0\ ^-fE!2^#RS,LT^lg^^-^i-o^TU& 
/<^^^5 (Xl^— ^(^j:oxaS«S^S<cfto5 



(6) 
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[0 0 16] 1112(3:. (**i5M 3S&t;:BBi-5» 

l^S Q SEKO^xy^-Cfi. B#i»j5 s XConvertSelectio 
n^n K:a/Ug3ftS:ttlU Xlr—^SelectionRe 
questLabel^n ha/V^Cfft SelectionRequest 10 

tR^*-^/&^JB<Z>^ ^ K^-tT^n^yV 

U aRSB<^Sf*#*;MftT*-£0)!?-< V K^_bT*^^jl 

te^T" T*SelectionRequest££/&U ^.tl^Mc^ 

{-MM Ufegff fflJdiUff t6 0 Ctttt«2pWSelectionR 
equest*#>#<7>T\ ^(Z)««-C«IBi-5 «fc 5 i-Sfffi'J^ 

= — K*3E3Ei-Si^Stt3fct\ 20 
[0 0 17] iltR-^-^-rfS, rtD^T^^ef*:^ 

* y ^ 5 Til^-* — v> ^ CQt/u /Nf TittR^ 
LTSelectionNotify*^^rt±ii- 0 Wciii^-*-;^ 

#S£5I-#S 0 S**Bif!)Pi-i:, ^f^yst^S 30 

w£ a* -e# So atR-^-*— ^ 

X^ry^l Om S^a s *rL^XTransferP 
ropertyPfmbSrffifflU-C. ^frl&{$<D $ > W /zf 

t-atR«i^-*£:tei£i-So fti-as^*—^**;* 

T-y^l 1 TSelectionNotifyl^ft L££riU -^fiOjg 
TG^XConvertSelectionP^tfi LJ-Jt^ £ ^/c 

IS "9 , ftd* ^ 7^13 T?XPropertyNotifyPfttJ USrffl 

u joists. a^^-^^tr**dsaifs**xSo a 

[0 0 18] B3fl, i#5xaiR^B^ei££;^T^S£ 50 



So *t4M»R«@tt, low»R«|i:UtffJ4<, 
#t^t>cD-C£>6 0 c^Pha/Hl, B*fl!ia s £i ifi -£*t 

ttt^o ^^lUfiXConvertSelection^^ h =*/l"ff*S: 
fflU -tttSrXi^—^^dSSelectionRequestLabel^n h 

s/UKjfcMaHftU SelectionRequestLabel^^ LT 

#) ^atR-^-* — v^tD^ v K^-kTSeo^n^TV 

7^:7*6 T\ CttdS*ii> (INC 
R) »#l«@-Cfc5£t*jgS^*— C^lrilfcnhSSe 
lectionNotify^:tHi*o Lfc^oT, atR-^ — >^ 

7" y 7 7 THIS** g Br*#a> S> g «*ffl9i-*t^ 

(wjKsns^-^Sr^-— ^«aE-e#s«t 5i-^s 0 s 

^-e#S 0 ^7^^9X11 iliR-^-^-^^^^V^XT 
ransfer Property f^HJ b^:^^ IT, ^tlSfcOV^l/ 

^-Tii, ^v'y^l OTSelectionNotify (I NCR) 

So HBRO^— ^tei^fi. ^xy^l l~14t-lw 
ChangeProperty^ — i? t Property Notify^ ^/ir — is 

-C^S^^^-ifi^-^^So a^^-^^ii, l[el 

^^7><b bT^^tuco^^^-rso roa^ 

«*flldSfigiJOXconvertselectionB*S:aifS"**S 

So 

[0 0 19] CiO^n h=i/K^*S^^^S'^i, 

y^i 3(^i-«t >^p^<7"-<3fW#i6 s a^*— 
7^1 4Tcw»«*as^3sas3ftfflii^te5Si-6o -tt 



11 

5—1 7 com— ^^^T — ^ (OX 0 (w/N^^^r— • 

7u >- ^-r SrBHWS Z t t-*-5o 
[0020] r co^nir^^o^xd, 13 4 0580x0 M 

f^XConvertSelection^^ iH -5 0 £ <£>Xconvertselecti 

fi, X1J— s<U^ SelectionRequestUbel*4fe£l^5*T 
U I t Uw <^SelectionRequest*#i «r»R-^* — 

C, 3-— f ID (U I D) x If /U — /I D (G I D) 

[o o 2 i] m^rn 4 z>t. ^-rmwr^vvi? 

4 0 ^^{fJOOMAC (Rmac) dS0T*"#<Z)M 

AC (Omac) <£9^#l^\ ^Ll/^\ /hSo^S: 

SFf^n y^4 0 2 ^^-d5W*Tffi:»fT#-C*>-5^ 30 

£ixT^6^5^£ffiti£-r6 0 ^-rtu^4B^i-t. 38 
>f * >?^r (xdm) \z. j;ot/H h • & ^ > K ^ 

^7^-^i:Lta-f id (UID) *3j:tWVi' 
—^I D (G I D) ££:Jg^LT, A I X<D t c 1 (* 40 

tHL) ^:ft5o (A I Xfi I BM^ffiit^ 1 ? , UN I 

[0 0 2 2] WWf^n 0 2 T^-if ^WttTflH* 

fT#"C*> S ^ if 5^**^*^-5^ ><, h*fT5^— 

-t<oje*. mm?* v$ 4 0 4t^-rj: 5 

***** Sit, ttttB:/ p^4 0 5 "es*ftl(w5feasc»**s 50 
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15 1:^5/7^7 7^^^, «|6^Dy^4 0 

feti/6*Srir«tB^ny^4 0 ^dssac 

TOKj Sr3B*^b/S:»&#i. n y ^ 4 0 8 TBSlE 

Sift, 5 „ £i^5<0«\ Tte#?Tti^— iFofc 

[0 0 2 3] WKfr^n 7^4 0 3 T-±fe^T^fFpJ 

Hei^-f/Ks/^ry^s^Stt-So C*x 
fi. MAC±ft»ffl|ft-C*5o a-— f*dS rffiJBLj S: 

fW6i:^f/K7y7 7 7 J t TOKj Sr38RLfcd\ 
»n7^4 0 l-c*J^SixfcJ;5t-S*:ffll!>-f 
7MAC ir^f^rf^nir^MAC^^UV^^tc*^ ^fj 

Wf^n;y^4 1 1 "C*^r ^"fe^dS«*Snfe^if 5 

60 Wdj/7 4 l 2-cW^SttfcJ:5^, ^--1?^ 
8i:^7y7 7^^^^5o Scl-aMB^ns,^ 

4 0 5-es*flai^5c»**dS26e>tt, ^t 1 ^^^* 

dSfffcttSffirt^ttlffi^o 7NO6 T^tR-^^-^Y^ 
EaE**Sr^-t"5, ^— ^Hrj^i-sKy^r 7 7° 
T? TOKJ ^iltRUfc^\ Wn7^4 1 1T«^ 

^7^41 3T^^r#^^n/^^^##iAtfc Wig 
yP7^4l4m * ^{r^— 3*1,-5 SrIR 

5>a*f=:K3g-r5o mzmmyw? 4 1 stu 1^9 
^Trr-rzK ^ -7*7 ^ ^^^^ $ ti, ^^tstit^-^i^m 

[0 0 2 4] CCDNF^T% rtt!&Slt^ (I NCR) Gill 
■e*>S^**iJSi-S^^ h»1^7^4 1 6T1t^ 

a 1 0 i:*t jK y t't s/ ^s*^ s ^ % ihko^— ?m 
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j&*&*#flMSfa&a«UTfc* 0 3KBBiib-Cfa«L/t 

Mtt:. Hl2|:^t!>-<yKWs$^S^ 0 2*5 Jit* 
^4 1 9T^>ir K— • . £«f >- K ^d*£>K*fflfl ^ V K 

[0 0 2 5] Ttt»fT^^:tt±ffi» 
y V • T v K • Mftf^<z>BTnrdSj-—if i^x. 

7" * L SrJt^ L fcSelectionNot ify*& SrS*ft|^ 
Mb, ^tR^nir^^r^T-T^o MACttat:& s J«5bUfc 

U aiR^*-^fiDAC&[&#T-fc6) fr±f&£th 
6o ^— 1>*B:MACRBHj& s — §J**U*^t#^^y h 

rat, r^ir^»j»y^h (acl) £f±«i(iB$U;i^-;* 

£4x£ 0 ^^^dSDACSriflHl-t-SJ: 5t-»j*Sttx 

0 8 \z^k-r^^m^ £ it. aiR^ffc 

DAC*36aV*5M-££. a*^*— *y h • 
7yK^-^FS«ffit5 r>>^ K— j ^^K 

t-j:tK aR«sj^#«:aiR«B7*-**K£i;:s# 

r^«t5^tis-e#6o ) r<>^ k— j 

Kl>ID^ r*>^ K-J ^n/^^ i D{2. atR^g^f 
>r>-K* I Dt/p^r^ I DO«;t>f9 dftfflSitSo 
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Br*r#a> e> B $ *u gf^r#*4SU^MAc^/H^*>si:' 
4<*s 0 -t<z>»a\ aiR-^-^f*. t^bt** 

£ Se lect ionRequest*& & fft^i" 6 US l - KAfflfl I 
D \z~tlb<D I D^rffA-T^o atR^ 

— *J -Y M\ ^*fl)<£> ^^K!) ±XPropertyNotifyWfe 

10 [0 0 2 6] 3f^r#^SelectionRequestV^^r§tt®l5 
7*— ^gpfiT***, XchangePropertyffmUSrffiffli- 

* h-T6o »c(ra»i3Si0f^r#tt. r->^ K-J 

^"?"Sel ect ionNot ify*#l Sr H*fll i-i^ff "t" 6 0 - ^Sel 
ectionNot ify*ft ttX i^— '< i- iot {+#S ^ tb. X 

**a^^— v^^idiSSo B*(lfl^7-f 

#^7^TVh<Offf#7^/^i:«:^tfo (Ctttt. a^ 

tl^o ) SelectionLabel^^^Sltt^^ , il^-^-^— 

IR»UTU^saR*i^#*s^-— 1^*Bwfc«)^«IS 

so ^^BSihSnSo atR-^^— v^te. 

i^l^T. a^B-r-^^WS^^/W'Sraife^^^ ^ 
K^iOiBft^^wfcSi^ ISA ft « 7 * « *« 

[0027] ±ia<o<t5(-, :^T0^^^n 
f$$tiz>o y6imi*$:miR\*itm&&s (icccmi^ 

lectionNotify*ft* s S*flli-36fettSo 3 

— f , dS*ja*7^</v4:A*-t'5 xy-.^y^y 

T'O^ ^ir — C/igci^" Invalid label please re-enter" 
so — 9*(i7-<^*WA*i-S«^S:»-5o ^^^^ir-v 5 



(9) 
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[0 0 2 8] f»*7^/^3S^^^ K!>£^ y 

fix ra«7^/^asn&oT^T&. (i*** 1 ^ iitR^i 20 

[0 0 2 9] ES-r*-i;t«:, J £<Dti)MWtm-7B-tx 
^ir tdK3lEff «SriSft -T 5o £ <£>AuditNotify*#* 30 

fc, k — j j^^yKJiDi: r*>^ 

~C^<5o M^^I^2^J:u ? Ig|3(^^^5/^ p 8{c^-r c J: 5 

f-iiHt^Tj y b • T 1/ K • * h • ^DtX (i">fe:b 
-^l:ioT AuditNot ify #3* <b *L -5 , £ 

— v>fi F-J ^yK^IDfc K— J ^ 
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* — S^ir /^AuditNotify * y*&mfe L/tCl ientMessage 
s/77 — (Dmffi&^T L/c Z t ICtf 
[0 0 3 0] K3tE-^*— C^irA^foClientMessage*** 
nsferPropertytl/^5 X 1 i b 03l^ffl U&PftFfcti L"t\ 

:o^p/>'7^ a* e> r ^ * «Ttgi^ * -5 e 

XTransferProperty^tB U^5fe|fei--5 ^ . il^^^— 
ir * L ^ ^ 5 ^ — ^ £ttttfcSelectionNotify^#£ 
Srf^fiKL. r^^rS^fUt-ilKl-r^o XTransferPropert 

Sr^tfSelectionNotify** Srf^jfi w^b^r^^ilijfr 
iSfS-t-5o ICCCMS#l:J;!!), 5*«|»0^nA g 

PropertyNotify : iP^^i||f^$^ l ,^ a p r0 pert:yNo 
fi/t K-J ^-f ^ K^-b-CProperty Notify 

[0 0 3 1] h • ry K • h(i. BFF^"# 

Br^T#fi. Select ionNotify^^td I NCR^ 
lectionLabel^^i^^^o ±15^0 9 t-^i-J: 5 f-il 

[0 0 3 2] 3-— iftt. ^^ttoteiHr^tiiftW^^ 
/u • jTsfTtitr • x (Bii) 

^r^W-r^ - t &X~$ Z> Q »*«l(r:SelectionNotify* 

^mm-r^m^. mR-**— ncr^ 

ft^Ufc H ^o^°^>f {wBBi-SPropertyNoti 

fi S n ^rj^^ U fcPropertyNotify*^^^ ttSi 5 t . 



(10) 
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K— J ?us<7-4k K-J ^^K^SrfiiJ 

*^PropertyNotify*ft&§ttlX5o £*L"CJi5MEi£as 
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